SSH Reverse Tunnel – How to Configure SSH Reverse Tunnel from Config File

configurationsshssh-tunnel

I'm looking for a ssh client config directive like LocalForward that works as the -L CLI parameter but for the -R parameter

TL;DR full problem details

The data:

repoServer -> myComputer -> NAT -> stagingServer

I have a local git repository server that is not exposed to the internet and a remote staging server on which I have to deploy my repo.

To do so, I ssh into the remote stagingServer with a reverse socket.

Current configuration for myComputer:

File: ~/.ssh/config

Host StagingServer
  Hostname staging.acme.com
  User username
  PreferredAuthentications publickey
  IdentityFile ~/.ssh/id_username
  ForwardAgent yes

on which I run:
ssh StagingServer -R 8022:repository.local:22

Current configuration for stagingServer:

File: ~/.ssh/config

Host repository
  Hostname localhost
  User git
  Port 8022
  PreferredAuthentications publickey
  IdentityFile ~/.ssh/id_deployer

on which I can run:
git clone git@repository:myProject.git

And all works fine, but… finally

The question:

Is it possible to specify in the ssh client config file (~/.ssh/config) to open the reverse tunnel so that I haven't to add -R 8022:repository.local:22

Best Answer

Obviously what you are looking for is RemoteForward, you can find the specific in the ssh_config Doc...

Documentation: https://linux.die.net/man/5/ssh_config (Search for RemoteForward). It is self explanatory.

RemoteForward

Specifies that a TCP port on the remote machine be forwarded over the secure channel to the specified host and port from the local machine. The first argument must be [ bind_address:]port and the second argument must be host:hostport. IPv6 addresses can be specified by enclosing addresses in square brackets or by using an alternative syntax: [ bind_address/]port and host/hostport. Multiple forwardings may be specified, and additional forwardings can be given on the command line. Privileged ports can be forwarded only when logging in as root on the remote machine.

Then the configuration for myComputer becomes:

File: ~/.ssh/config

Host StagingServer
  Hostname staging.acme.com
  User username
  PreferredAuthentications publickey
  IdentityFile ~/.ssh/id_username
  ForwardAgent yes
  RemoteForward 8022 repository.local:22
Related Topic